Numerous Debian Project systems compromised [LWN.net]

Numerous Debian Project systems compromised

Posted Nov 23, 2003 12:20 UTC (Sun) by XERC (guest, #14626)
Parent article: Numerous Debian Project systems compromised

Well, but as with any cracking or hacking, it's clear, that IT HAD A SECURITY HOLE, and that fact doesn't depend on the party or person, who states that, even, if that party were Micro$oft.

Actually, what conserns to the technical aspects, then I suggest, that the first thing, that could be done in Linux in general, is to start using some of the OpenBSD packages and libraries. "Search/replace_all" the dangerous and historic C functions(like strcpy, etc.) with newer and safer ones, start using randmomized process ID's(may be Debian already uses those??), "chroot" the webserver's process to it's
own directory, stop using /tmp as a place for temporary files(use /tmp/usrname with chmod 0660), make as many operations as monolitic as possible,
check the operations return value, when creating files, make sure, that, when something is writeable, then it's not executeable, and vice versa, don't use easily predictable filenames for temporary files(date, proccessID, userID, etc), filter the strings against string-attacks(a string, that is written by overflow and can be intepretad as a machine code), pay attantion to double-intepretation(for instance,
PHP forbidden, CGI writes PHP code which get's then executed as PHP), etc.

All of the previous is doable withought manualy touching much of the existing code. OK, after that, well take a look at social engineering and may be Linux developers should more closely cooperate with OpenBSD developers when looking at the code from security's point of view. And again, "copy/paste" from OpenBSD as much as possible, specially those parts, that are at relatively mature states.

Hey, but why couldn't Debian be hosted on the
OpneBSD server? It's just a plain server, it doesn't have to be at such a
bleeding age? I think that it would be pretty OK, if OpenBSD were the final, robust, endproduct and various Linux distros were the development plathforms, where all new and exciting is tried and developed.

(Log in to post comments)